Reformat Log Line / Templates & Filter

This is the place for you, if you got rsyslog up and running but wonder how to make it do what you want.

Moderator: rgerhards

Google Ads


Reformat Log Line / Templates & Filter

Postby whitepj » Sun Sep 17, 2017 2:50 am

Hi All,
Bashing my head here. Can I have a pointer of what is wrong?

Plan is to have a local socket receiving very specific messages.
These need to be written out by a dedicated queue in a fixed format (very simple CSV format).
The end plan is that this will be sent via RELP, via an intermittent / unreliable link -- but I am testing with a simple logfile.

Most of the initial testing works -- with the exception of the format which is written out to the logfile.
(date format not correct, and hostname is still present)
I am also getting a syslog error about "please use ':omusrmsg:foo' syntax instead".

Code: Select all
template(name="foo" type="list") {
        property(name="timestamp" dateFormat="rfc3339")
        constant(value="-")
        property(name="msg")
        }

ruleset(name="tmp"
        queue.type="LinkedList"
        queue.filename="queue"
        queue.maxdiskspace="1G"
        queue.saveonshutdown="on") {
                action(type="omfile"
                file="/var/log/Temp-Output");foo
#       template="foo"
        }

input(type="imuxsock"
        Socket="/var/log/Receiver"
        CreatePath="on"
        useSpecialParser="off"
        ruleset="tmp"
        )


What am I missing?

Thanks
whitepj
New
 
Posts: 2
Joined: Sun Sep 17, 2017 2:29 am

Urgent Question?

  • Pulling out your Hair?
  • Wasting Time and Money?
  • Deadline Approaching?

Re: Reformat Log Line / Templates & Filter

Postby rgerhards » Mon Sep 18, 2017 4:40 pm

You are closing the action object too soon. Use

action(type="omfile"
file="/var/log/Temp-Output"
template="foo"
)
rgerhards
Site Admin
 
Posts: 3806
Joined: Thu Feb 13, 2003 11:57 am

Re: Reformat Log Line / Templates & Filter

Postby dlang » Tue Sep 19, 2017 1:58 am

the problem is probably that the log message isn't getting parsed the way you expect it to.

can you show an example of the message you receive.

write a message out with the format RSYSLOG_DebugFormat and you will see all the variables that you have.
dlang
Frequent Poster
 
Posts: 1001
Joined: Mon Sep 15, 2008 7:44 am

Re: Reformat Log Line / Templates & Filter

Postby whitepj » Tue Sep 19, 2017 8:57 pm

rgerhards wrote:You are closing the action object too soon. Use

action(type="omfile"
file="/var/log/Temp-Output"
template="foo"
)


Ahhh! Why didn't I see that?!

That's exactly it. I almost tried every combination except this one.

Thank so much.
whitepj
New
 
Posts: 2
Joined: Sun Sep 17, 2017 2:29 am

Google Ads



Return to Configuration

Who is online

Users browsing this forum: No registered users and 1 guest

cron